fix(ci): notarize release candidates like stable releases - #262
Merged
Conversation
The four notarization steps carried `&& !contains(github.ref_name, '-')`, which skipped them for every pre-release. Two costs, and the second is the one that mattered. Testers paid the first. A DMG signed with Developer ID but not notarized is still refused by Gatekeeper — `spctl` answers `rejected, source= Unnotarized Developer ID` — so anyone testing an RC had to know about `xattr -rd com.apple.quarantine` before they could open the build they were being asked to try. The release paid the second. Notarization never ran until the stable tag, so the first exercise of the credentials, the certificate chain and Apple's acceptance of every nested Mach-O landed on the highest-stakes build there is. The run that first enabled signing died in `Package .app bundle` on a malformed `MAC_CSC_NAME`; it was caught only because a full build was dispatched deliberately. Notarizing each RC makes every candidate a rehearsal. The trade is a few minutes per macOS job and a dependency on Apple's notary service being reachable, with `--wait` capped at 15 minutes. If that turns flaky enough to block RCs, the answer is `continue-on-error` on pre-releases rather than skipping them again. Five documentation sites asserted the old behaviour and are corrected here, so nothing claims RCs are unnotarized after this lands.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The four macOS notarization steps carried
&& !contains(github.ref_name, '-'), which skipped them for every pre-release —-rc.Ntags included. This removes that clause from all four.Why
Testers paid the visible cost. A DMG signed with Developer ID but not notarized is still refused by Gatekeeper. Measured on the v1.9.0-rc.1 bundle after signing it with the real certificate:
So every RC tester had to know about
xattr -rd com.apple.quarantinebefore they could open the build they were being asked to test. That drop-off does not show up anywhere.The release paid the cost that mattered more. With the skip in place, notarization never ran until the stable tag — meaning the first real exercise of the credentials, the certificate chain, and Apple's acceptance of every nested Mach-O landed on the highest-stakes build in the cycle.
That is not hypothetical. The very first run with signing enabled (30950523913) died in
Package .app bundle:A malformed
MAC_CSC_NAME. It was caught only because a full build was dispatched deliberately to test the pipeline. Under the old condition, that same class of drift would surface during a promotion.Notarizing each RC turns every candidate into a rehearsal of the path the stable build depends on.
Verified
Run 30952306419, a
workflow_dispatchonrelease/v1.9.0— which notarizes today only because the branch name happens to have no hyphen:status: Acceptedalso settles an open question: Apple inspects every Mach-O in the bundle, so the three helpers underContents/Resources/electron/native/bin/do inherit the Developer ID from electron-builder. They are not reached by a manualcodesign --deep, only by electron-builder's own signing pass.Trade-off
A few minutes per macOS job, and a new dependency on Apple's notary service being reachable —
--waitis capped at 15 minutes. If that ever turns flaky enough to block RCs, the answer iscontinue-on-erroron pre-releases, not restoring the skip. Not adding it pre-emptively.Documentation
Five places asserted the old behaviour and are corrected in the same commit, so nothing claims RCs are unnotarized once this lands:
AGENTS.md,.harness/docs/git-workflow.md, and thebuild-and-packaging,ci-workflowsandrelease-and-secretspages.npm run docs:checkpasses (22 files).Related issue
Refs #
Type of change
Release impact
Desktop impact
Testing
Workflow YAML parses (
js-yaml);npm run docs:checkOK. Nocontains(github.ref_name, ...)remains inbuild.ymloutside the explanatory comment. The notarization path itself is proven green by run 30952306419 above — this PR only widens which tags reach it.